1. Field of the Invention
The invention relates to an apparatus for high performance switching in local area communications networks such as token ring, ATM, Ethernet, Fast Ethernet, 1 gigabit and 10,000 Mbits/s Ethernet environments, generally known as LANs. In particular, the invention relates to a method and apparatus for enabling and controlling access on a network switch.
2. Description of the Related Art
As computer performance has increased in recent years, the demands on computer networks has significantly increased; faster computer processors and higher memory capabilities need networks with high bandwidth capabilities to enable high speed transfer of significant amounts of data. The well-known Ethernet technology, which is based upon numerous IEEE Ethernet standards, is one example of computer networking technology which has been able to be modified and improved to remain a viable computing technology. A more complete discussion of prior art networking systems can be found, for example, in SWITCHED AND FAST ETHERNET, by Breyer and Riley (Ziff-Davis, 1996), and numerous IEEE publications relating to IEEE 802 standards.
Based upon the Open Systems Interconnect (OSI) 7-layer reference model, network capabilities have grown through the development of repeaters, bridges, routers, and, more recently, “switches”, which operate with various types of communication media. Thickwire, thinwire, twisted pair, and optical fiber are examples of media which has been used for computer networks. Switches, as they relate to computer networking and to Ethernet, are hardware-based devices which control the flow of data packets or cells based upon destination address information which is available in each packet. A properly designed and implemented switch should be capable of receiving a packet and switching the packet to an appropriate output port at what is referred to wirespeed or linespeed, which is the maximum speed capability of the particular network.
Basic Ethernet wirespeed is up to 10 megabits per second, and Fast Ethernet is up to 100 megabits per second. The newest Ethernet is referred to as 10,000 Mbits/s Ethernet, and is capable of transmitting data over a network at a rate of up to 10,000 megabits per second. As speed has increased, design constraints and design requirements have become more and more complex with respect to following appropriate design and protocol rules and providing a low cost, commercially viable solution. For example, when filtering packets in a switch based on assigned criteria, if the filtering process delays the processing of a packet by the switch, then it becomes almost impossible to operate the switch or the network at linespeed.
One system of filtering packets in a network switch is discussed in U.S. patent application Ser. No. 09/343,411. Such a switch employs a Fast Filtering Processor (FFP) to perform the desired filtering. Filter masks are applied to portions of the incoming packet and a Rule Table is searched for actions to be taken if there is a match with a key found in the Rule Table. The general process of filtering with the FFP is discussed below with respect to the present invention.
Another aspect that is important in a network environment is the policing of traffic. Traffic policing is crucial in running a network for security and performance reasons. A policy, implemented for a network environment, determines which type of data traffic is allowed to the network. Implementing an Access Control List is a basic mechanism for a network administrator to control the traffic. However, prior art switches and systems have limitations that can impede the overall effectiveness of such policing and can adversely affect the operational speed of a switch. Thus, there is a need to provide access control of switched data through a network switch that does not impede the processing of data by that switch.